CVE-2026-40191 ClearanceKit has a policy bypass via dual-path Endpoint Security events checking only source path
Local attackers can bypass file-access protections in ClearanceKit by using dual-path operations that ignore destination path checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-40191?
CVE-2026-40191 is a medium-severity vulnerability in craigjbass clearancekit, published on 10 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.4-beta-1f46165, ClearanceKit's Endpoint Security event handler only checked the source path of dual-path file operations against File Access Authorization (FAA) rules and App Jail policies. The destination path was ignored entirely. This allowed any local process to bypass file-access protection by using rename, link, copyfile, exchangedata, or clone operations to place or replace files inside protected directories. This vulnerability is fixed in 5.0.4-beta-1f46165.
Weakness: CWE-863
Which versions are affected by CVE-2026-40191?
How do I fix CVE-2026-40191?
No fix has been published for CVE-2026-40191 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-40191 being exploited?
There is no known exploitation of CVE-2026-40191 in the wild and no public exploit code.
Sources
Also known as GHSA-92f3-38m7-579h.